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Abstract: We consider the problem of approximate consensus in mobile networks containing Byzantine 
nodes. We assume that each correct node can communicate only with its neighbors and has no knowledge 
of the global topology. As all nodes have moving ability, the topology is dynamic. The number of Byzan- 
tine nodes is bounded by / and known by all correct nodes. We first introduce an approximate Byzantine 
consensus protocol which is based on the linear iteration method. As nodes are allowed to collect infor- 
mation during several consecutive rounds, moving gives them the opportunity to gather more values. We 
propose a novel sufficient and necessary condition to guarantee the final convergence of the consensus pro- 
tocol. The requirement expressed by our condition is not "universal": in each phase it affects only a single 
correct node. More precisely, at least one correct node among those that propose either the minimum or 
the maximum value which is present in the network, has to receive enough messages (quantity constraint) 
with either higher or lower values (quality constraint). Of course, nodes' motion should not prevent this 
requirement to be fulfilled. Our conclusion shows that the proposed condition can be satisfied if the total 
number of nodes is greater than 3/ + 1. 

Key-words: agreement problem, approximate consensus, Byzantine fault, distributed system, necessary 
and sufficient condition, dynamic topology, mobility, ad-hoc network 
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Resoudre le probleme du consensus approximatif 
en presence de Byzantins 
dans un reseau mobile partiellement connecte 

Resume : Nous considerons le probleme du consensus approximatif dans des reseaux mobiles contenant 
des nceuds byzantins. Nous supposons que chaque nceud correct ne peut communiquer qu'avec ses voisins 
et n'a pas connaissance de la topologie globale. Comme tous les nceuds ont la possibilite de se deplacer, la 
topologie est dynamique. Le nombre de nceuds byzantins est borne par / et est connu de tous les noceuds 
corrects. Nous presentons tout d'abord un protocole de consensus approximatif byzantine qui est fonde 
sur la methode d'iteration lineaire. Comme les nceuds sont autorises a collecter des informations lors de 
plusieurs tours consecutifs, le fait de se deplacer leur donne F occasion de recueillir plus de valeurs. Nous 
proposons une nouvelle condition necessaire et suffisante pour garantir la convergence finale du protocole 
de consensus. La contrainte exprimee par notre condition n'est pas "universelle": lors de chaque phase, 
elle ne concerne qu'un seul nceud correct. Plus precisement, au moins un noceud correct parmi ceux qui 
proposent la valeur minimale ou la valeur maximale presente dans le reseau, doit recevoir suffisamment 
de messages (contrainte sur la quantite) contenants des valeurs superieures ou inferieures (contrainte sur 
la la qualite). Bien entendu, les deplacements des noceuds doivent permettre a cette condition d'etre 
remplie. Notre conclusion montre que la condition proposee peut etre satisfaite si le nombre total de 
nceuds est plus grand que 3/ + 1. 

Mots-cles : probleme d' accord, consensus approximatif, faute Byzantine, systeme reparti, condition 
necessaire et suffisante, topologie dynamique, mobilite, reseau ad-hoc 
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1 Introduction 

We consider a distributed system where nodes are mobile and form an ad hoc network characterized by 
a dynamic topology. When a node changes its physical location by moving around, it also changes the 
set of its neighbors with whom it can communicate directly (roughly speaking, nodes that are physically 
nearby). The system is unreliable. Nodes may suffer from Byzantine faults and messages may be lost. A 
Byzantine node, also called a malicious node, may stop its activity or execute arbitrary code. In particular, 
it may send messages with fake values. Nodes that are not malicious are said to be correct. 

Consensus is recognized as a basic paradigm for fault-tolerance in distributed systems. According 
to the application's needs, several variants of the consensus problem have been proposed. Among these 
agreement abstractions, one is called the Approximate consensus problem and has been presented for 
the first time in [ 1 1. Each node begins to participate by providing a real value called its initial value. 
Eventually all correct nodes must obtain final values that are different from each other within a maximum 
value denoted e (convergence property) and must be in the range of initial values proposed by the correct 
nodes (validity property). Approximate consensus can be used in applications (clock synchronization, 
distributed data fusion,. . .) that do not require to achieve exact agreement on a single outcome value. 

Several protocols have been proposed to solve this problem in the presence of Byzantine nodes. Some 
protocols H] assume that the network is fully connected: during the whole execution, a correct node 
should be able to communicate by message passing with any other correct node. Obviously, this prop- 
erty is not satisfied in our context. Other protocols J3] IU [5] consider partially connected networks but 
require an additional constraint: any correct node must know the whole topology. Again, such a global 
information is impossible to obtain in our context. Based on the linear iterative consensus strategy |6], 
recent protocols J71|8]|9l also assume that the network is partially connected but do not require any global 
information. At each iteration, a correct node broadcasts its value, gathers values from its neighborhood 
and updates its own value. Its new value is an average of its own previous value and those of some of its 
neighbors. Like in [H, before computing its new value, a correct node must ignore some of the values it 
has collected. These removed values may have been proposed by Byzantine nodes and may invalidate the 
validity property. In order to achieve convergence, the proposed solutions rely on additional conditions 
that have to be satisfied by the topology. In QO, the proposed conditions are proved to be sufficient and 
necessary in the case of an arbitrary directed graph. 

The solution presented in this paper addresses the approximate Byzantine consensus problem in 
Partially-Connected Mobile Networks. It follows the general strategy proposed in ||7]|8]|1). However, 
it differs from these previous works for two main reasons. First we modify the iterative protocol to 
cope more efficiently with mobility. Each node still follows an iteration scheme and repeatedly executes 
rounds. Yet a round is now decomposed into two parts: a moving step followed by a computing step. 
Furthermore, during the computing step, a node still broadcasts its value, gathers values and updates its 
values but now the values used to compute its new value have not necessarily been received during the 
current round. In other words, a correct node can now take into account values contained in messages 
sent during consecutive rounds. An integer parameter (denoted R c hereafter) is used to fix the maximal 
number of rounds during which values can be gathered and stored while waiting to be used. Thanks to 
this flexibility, a node can use its ability to travel to collect enough values. The second difference is the 
most important one. While the solutions proposed in (7] [8j |9] define conditions that refer only to the 
topology, we present a condition that considers also the values proposed by correct nodes. To understand 
the interest of our approach, let us consider the following example. One correct node pi proposes an 
initial value v a while all the other correct nodes propose an initial value v^. In this particular scenario, if 
the node pi can receive values from a sufficient number of correct neighbors, approximate consensus can 
be reached even if all the other nodes are isolated and receive no message. This example suggests that the 
location of values is just as important as the network topology. In (71 13, constraints on the topology en- 
sure that each node has enough neighbors. These constraints are "universal" because they affect all nodes 
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in the network. In a mobile environment, it is difficult to ensure that no node is never isolated from (or 
insufficiently connected to) the rest of the network. Furthermore, the above example shows that a strong 
universal constraint is not always necessary. In this paper, a novel sufficient and necessary condition is 
proposed. In this condition, topology and values proposed by correct nodes are both taken into account. 
The condition affects only a subset of nodes that can change from one round to another. More precisely, 
the condition focuses only on the correct nodes that propose either the maximum or the minimum value 
and imposes no obligation on the other nodes. To achieve consensus, from time to time, at least one of 
these particular nodes must receive enough messages (quantity requirement) with values different from 
its current value (quality requirement). Obviously, the constraint is weaker and not universal as it has to 
be satisfied by a single node. 

The rest of this paper is organized as follows. Section [2] introduces the model and provides a formal 
definition of the approximate consensus problem. In Section [3] we present our protocol based on linear 
iteration and we prove that correct nodes will never violate the validity property by adopting illegal 
values. Section[4]sketches out some related works. To ensure convergence, Section[5]proposes a sufficient 
condition. Then this condition is slightly modified to obtain a sufficient and necessary version. Section [6] 
brings our concluding remarks. 

2 Model and Problem Definition 

2.1 Model 

We consider a mobile distributed system composed of n nodes V = {pi,p2, During the entire 

period of computation, each node pi can move towards any direction and at any speed within a lim- 
ited geographical area. Nodes communicate with each other only by exchanging messages. A node can 
only communicate with its close neighbors. Therefore the topology (i.e., the communication graph) is 
dynamic. When receiving a message, the receiver knows the correct identity of the sender. The commu- 
nication is synchronous. Messages can be lost but there are no duplicate messages and each channel is 
FIFO. 

Nodes are divided into two subsets denoted C n and F n . The set C n contains the correct nodes which 
always follow the protocol's specification. The nodes of the set F n are Byzantine nodes. They behave 
arbitrarily and can collude together. In particular, each of them can stop its computation or send mes- 
sages with different fake values to different neighbors. No assumption restricts their possible behaviors. 
However, the total number of Byzantine nodes is limited by /. 

The protocol described in Section[3]is based on an iterative process. A sequence of rounds is carried 
out by each node. A round is identified by a round number r that belongs to the set R = {1, 2...}. For 
simplicity, the schedulers of all correct nodes are assumed to be fully synchronous. Each round r is 
divided into two parts denoted r m (mobility part) and r p (protocol part). During r. m , a node can either 
move to a new location or stay in the same place. During r p , a node pi broadcasts its value v, gathers 
values, and updates its state: a consensus protocol (such as the one proposed in Section 3) describes the 
computation performed by pi during a round. 

The behavior of a correct node pi during 4 consecutive rounds is described in Figure [T] Just before 
executing round r\, pi is located in l a . During the first part of round r\, pi moves to another location 
lb and executes the protocol. The node pi remains in location i& during round r-i and executes again the 
protocol. It moves to l& during round r 3 and executes the protocol. In round r^, Pi moves to location l c 
and it executes the protocol for the fourth time. 

During a round r, a simple directed graph G r (V : E r ) is used to model the dynamic topology. If 
during round r, node pi can receive a message from a node pj located in its neighborhood then there is a 
directed link from pj to p$ : (pj ,pi) <E E r . In the proposed protocol, a correct node pi can receive a value 
during round r, keep it during several consecutive rounds, and use it in a future round r + k. Therefore, 
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location/l 




r, : round number 
r m : moving part 
r p : protocol part 



time/t 



Figure 1 : Path followed by node pi during 4 rounds 



the concept of joint graph ifTUl is also used within this paper. A joint graph is defined as the union of 
the graphs corresponding to several well-identified consecutive rounds. Figure [2] illustrates this concept 
in the particular case of two consecutive rounds r\ and r%. The graphs G ri (V, E ri ) and G r2 (V, E r2 ) are 
depicted on the left side. The corresponding joint graph appears on the right side. 



pi Pi 



Pi Pi 



Joint graph of r\ and 



Pi Pk 



Figure 2: Two graphs and the associated joint graph 



2.2 Definition of the Agreement Problem 

Within this paper, the value of a correct node pi at the beginning of round r is denoted W, (r) . Consequently 
the initial value of pi is denoted Vi(l). The minimum (respectively maximum) value proposed by correct 
nodes during round r is denoted v min (r) (respectively v max (r)). 

Definition 1. The approximate Byzantine consensus problem is formally defined by two properties: 
Validity property: 

During any round r, the value of a correct node is in the range of initial values of correct nodes: 

Vpi E C n , Vr > 1, Vi(r) £ [ (i)] 
Convergence property: 

Eventually all correct nodes have values which are different from each other within a maximum prede- 
fined value denoted e and such that e > 0. 

Vpi,Pj € C n , 3N > 0, Vr > AT, | Vi (r) - v 3 (r) \< e 



3 The Protocol and its Safety Proof 
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Algorithm 1 Linear Approximate Byzantine Consensus 

1: r <- 1; 

2: Vi(l) «— the initial value proposed by p»; 

3: Nebi(l) 4- null; 

4: for any node pi in round r; 

5: do; 

6: pi sends «; to its neighbors; 

7: pi waits for receiving messages; 

8: Nebi(r) «— {new values from neighbors }UA/e&i(r); 

9: Nebi(r) <-son(Nebi(r)); 

10: x <s— the number of values bigger or equal than Vi(r); 

11: y the number of values less or equal than Vi (r) ; 

12: if (x > / + 1 or y > / + 1) then 

13: Nebi(r) <- reducing(7Ve6i(r), /, x, y); 
14: Vi(r + 1) ■<— average(7Ve6» (r) , Vi(r )); 
15: Nebi(r + 1) <- null; 

16: else 

17: Wj(r + 1) 

18: if (r mod R c equals to 0) then 

19: 7Ve& 4 (r + 1) <- null; 
20: else 

21: Nebi(r- + 1) <- Neb t (r); 

22: end if 

23: end if 

24: r <- r + 1; 

25: enddo; 

26: Procedure reducing(iVe&i(r)), /, x, y); 

27: do; 

28: B <— the set of / largest values in Nebi(r); 

29: S the set of / smallest values in Nebi(r); 

30: if x > y then 

31: Suppress all the values of B; 

32: Suppress the values Vj € S such that Vj < Vi(r); 

33: else 

34: Suppress all the values of S; 

35: Suppress the values Vj G B such that vj > Vi(r); 

36: end if 

37: enddo; 

38: Procedure average(iVe&i(r), u;(r)) 

39: do; 

40: ni <-\ Nebi(r) |; 

41: « ne » ^ " i(r „t-S J '" J ' ^ G ^(r); 

42: return w„ etu ; 

43: enddo; 



3.1 An Iterative Protocol 

The pseudo-code (See Algorithm 1) is executed by all the correct nodes during the second part of each 
round r > 1. 
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The execution of the three first lines initializes the three main variables managed by a node pf. its 
current round number r, its current value (r) and a multi-set Nebi which is used to store values received 
from neighbors. From time to time, Nebi is reset to null, in accordance with a strategy explained later. 
The rest of the code is divided into two main stages called gathering (line 6-11) and updating (line 12-24). 

Node pi and its neighbors exchange their values (line 6-7). The received values are logged into the 
multi-set Nebi (line 8). A received value can be kept in Nebi during at most R c rounds (See the test at 
line 18). During a round r, pi receives at most one value from each (correct or Byzantine) node. But 
if Nebi has not been reset for several rounds, pi can receive a value Vj(r) during round r while a value 
Vj(r — k) previously provided by the same node pj is already in Nebi. In that case, pi keeps only the 
most recent value. When pi stops collecting values, all values of Nebi are sorted into ascending order 
(line 9). 

To guarantee the validity property, a correct node pi must gather enough values to be allowed to 
compute a new value (line 14). Otherwise, pi has to start the next round with the same value (line 17). 
During round r, the test evaluated by p, at line 12 defines two favorable cases: either pi has received 
values that are greater than or equal to Vi(r) from at least / + 1 different nodes, or pi has received values 
that are smaller than or equal to Vi (r) from at least / + 1 different nodes. If pi has received less that / + 1 
values from different nodes, the test cannot be satisfied. If pi has received values from at least 2f + 1 
different nodes, the test is necessarily satisfied. If pi has gathered more than / values but less than 2/ + 1 
values, the test can be satisfied or not. 



y » 



151=/ iei=/ 
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largest smallest 
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Figure 3: The reducing procedure 



When the test of line 12 is satisfied, pi executes sequentially the reducing procedure (line 13) and 
the average procedure (line 14). Reducing operation has been introduced in (TJ. To ensure the validity 
property, a few values have to be removed from the multi-set Nebi(r). The strategy used in this paper 
leads to suppress between / and 2/ values while the strategy used in JT] leads to always ignore exactly 2/ 
values. To choose the removed values, pi compare the received ones with its own current value u,. Within 
the set of values Nebi(r), B is defined as the subset that contains the / largest values (line 28) while S is 
defined as the subset that contains all the / smallest values (line 29). Due to the fact that the test of line 
12 is satisfied, either at least / values in Nebi are greater than or equal to u, (case a) or at least / values in 
Nebi are smaller than or equal to Mj (case b). The two cases (a and b) are depicted in Figure [3] where the 
sorted set Nebi is represented by a rectangle. Note that the two cases are not mutually exclusive. Thus, 
the two representations of Nebi(r) that appear on the right side of Figure [3] are equivalent and may lead 
to suppress 2/ values {i.e. all the values of B and S) if Vi belongs neither to B nor S. Less values will be 
removed if we consider the two representations on the left side. In case a, only the values of B and the 
values vj of S such that Vj < Vi(r) are suppressed from Nebi. In case b, only the values of S and the 
values Vj of B such that Vj > Vi (r) are removed. 

After reducing, pi executes the average procedure, pi considers only the remaining values of Nebi (?")• 
It calculates average with the values in Nebi(r) and Vi(r). The weight is simply set to | Nebi(r) | +1 
and v.i(r + 1) is assigned to the computing result. Then Nebi(r + 1) is reset to null (line 15). 
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3.2 Resetting the Log of Values Nebi 

The variable Nebi is initialized to null (line 3) and can be reset to null in two different cases (line 15 
and 19). As indicated in the previous paragraph, all the gathered values are suppressed when the node pi 
computes a new value during the round r (line 15). Therefore, in the future, this node will only use values 
issued during a round higher than r. 

In a mobile environment, a node is sometimes isolated or at least weakly connected to the rest of 
the network. The number of values collected during a given round is sometimes low. If a reset is made 
systematically at the end of each round, the test of line 12 (used to control if enough values have been 
gathered) is rarely satisfied. By reducing the frequency of reset operations, a node can collect more 
values over several consecutive rounds. Thus it may take advantage of mobility to increase the number of 
discovered neighbors. Consequently, the probability that it can frequently calculate a new value increases. 
Yet the reset operation is very important and is a key element in the proof of the convergence property. 
A periodic reset operation cleans the system of old values. If a mobile node pi moves far away and keep 
some very old values in Nebi for a long period of time (which is not bounded by a number of rounds), a 
negative impact on the convergence can be observed. 

In the proposed protocol, a general reset is performed by all the correct nodes every R c rounds (line 
18 and 19). By construction, line 19 is executed during a round r such that r = kR c with k > 1. The 
execution of line 3 during the initialization phase can also be considered as a general reset performed 
during a Active round numbered 0. We define the set S c as the set of all the rounds r c such that the 
instruction "Nebi(r c ) null" as been executed either at line 3 or at line 19 of round r c — 1. These 
rounds are called common new starting rounds. By definition, S c = {r c \ r c = kR c + 1 with k > 0}. 
The common new starting rounds allow to divide the computation into phases. Each phase is identified 
by the value of the integer k and is composed of R c rounds. We define also the concept of local new 
starting round as follows. From the point of view of a correct node p. L , r is a local new starting round, if 
either r = 1 or pi resets Nebi to null during round r — 1. The set of all local new starting rounds of pi 
is denoted Si. Obviously, for any correct node pi, S c C S{. By definition, during a phase, a correct node 
Pi executes a reset operation at least once (during the last round of the phase) and at most R c times (each 
time a new value is computed). The local new starting rounds of a correct node pi are used to identify 
some particular joint graphs (See Section|2]l. Let r be a round executed by pi. By definition, there exist 
a unique local new starting round r Sl £ Si such that r Sl < r and for any r S2 E Si either r S2 < r Sl or 
r < r S2 . Round r Sl is p^s latest new starting round. The joint graph corresponding to the union of the 
communication graphs observed during the non empty sequence of consecutive rounds beginning with 
r Sl and ending with r is used to identify the nodes which have communicated their values to pi during 
this period. In this paper, the notation JN£ is used to represent the joint neighbor set of p t at round r, 

3.3 Validity Property and Legal Values 

Theorem 1. The proposed protocol satisfies the validity property. 

Proof. Obviously, the property is satisfied during the first round: Vp; G C n , fj(l) € [w m m(l), v max (l)]. 
Let us consider that the property is satisfied during any round smaller than or equal to r. To violate the 
property during round r + 1, at least one correct process pi must modify its value during the execution 
of the average procedure and must adopt a new value with is either smaller than V m i n (l) or greater than 
u mnl (l). Due to the properties of the average function, at least one value that is either smaller than 
Wmm(l) or greater than v max (l) must appear in the multi-set Nebi(r). A value v contained in this 
set is either proposed by a correct node or by a Byzantine node. In the first case, due to the induction 
assumption, v belongs to the range [v m i n (l),v max (l)]. In the second case, v can remains in Nebi{r) 
after the execution the reducing procedure only if at least / + 1 fake values have been gathered. As the 
number of Byzantine nodes is bounded by /, the validity property is always satisfied. □ 
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Some works |7 1 adopt a property which is stronger than the above validity property. During the whole 
computation, the maximum value proposed by a correct node has to be monotonically non-increasing 
and similarly the minimum value has to be monotonically non-decreasing. More precisely, for any round 
r > 1, the conditions v m i n (r) < v m i n (r + 1) and v max (r) > v max (r + 1) must hold. The proposed 
protocol can satisfy this stronger property if and only if R c — 1. When R c > 1, as a correct node pi may 
keep old values in its log Nebi(r), the above conditions are not always true. The new value computed 
by pi during round r, namely Uj(r + 1), may be less than v min (r) or bigger than v max (r). To take this 
possibility into account, we define first the concept of legal value and then we propose a safety property 
which is stronger than our original validity property. 

Definition 2. Let r by a round number such that r — kR c + to with k > and 1 < to < R c . The 
value Vi{r) of a correct node pi is legal if the two conditions Uj(r) > v m i n (d) and Vi{r) < v max (d) are 
satisfied when the round number d is defined as follows: 

1. (k = 0) A (m = 1): d = 1 

2. (m ^ 1): d = kR c + 1 

3. (k ^ 0) A (to = 1): d=(k- 1)R C + 1 
Lemma 1. Vpi € C n , Vr > 1, v t (r) is legal. 

Proof. Depending on the round number r = kR c + to, three cases that are mutually exclusive have 
to be considered. When m = 1 and k = 0, the value of a correct process pi is in the range 

[u m i„(l), v max (l)]. In the two remaining cases, we prove that u$(r) < v max (d). A similar demonstration 
can be done to conclude that V{(r) > v m i n (d). 

If to ^ 1, then r is not a common new starting round. The nearest previous common new starting 
round is d = kR c + 1. As to > 1, we have r > d. By definition, at the beginning of round d, every 
correct node pj has no value in its set Nebj(d). Furthermore, at that time, for any correct node pj, the 
property Vj(d) < v max {d) holds. Now the proof is by contradiction. Let us consider that r is the very 
first round greater than d during which at least one correct node violates the property. Thus, we have 
Vi(r) > v max (d). The computation of the value Vi(r) has been done by pi during the previous round 
r — 1. All the values used during the execution of the average procedure by p. L have been received by p. L 
during round r — 1 and may be during rounds r — 2, . . .,d + 1 and d. In all the possible cases, any value 
v received from a correct node is such that v < v max (d). To have still a value greater than v max (d) and 
thus greater than Vi(r — 1) in its log Nebj(r — 1) after the execution of the reducing procedure, pi must 
gather f + 1 fake values. This contradicts both the fact that the network contains at most / Byzantine 
nodes and the fact that a node (correct or not) cannot insert two different values in the multi-set Nebi of 
a correct node pi. 

If m = 1 and k > 0, then r is a common new starting round. The value Uj(r) has been computed by 
Pi during the round r — 1 = kR c and Nebi(r — 1) may contain values proposed during the R c previous 
rounds. As the round d = (k — l)R c + 1 is also a common new starting round, a similar reasoning leads 
to conclude that Vi(r) < v max (d). □ 

Note that after the execution of the reducing procedure , all the remaining values are legal. The 
following corollary focuses on the common new starting rounds that identify the beginning of phases. 
This corollary can be considered as our new safety property. 

Corollary 1. Safety property: 

V?' € S c , Vp 4 e C n , yx > 0, Vi(r + x) > v min (r) and v,(r + x) < v max (r) 
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Proof. As r € S c , there exists an integer k > such that r = kRc + 1. When x = R c , we have 
r + x = (k + l)Rc+ 1. Due to lemma 1, we conclude directly that the two conditions holds. When x 
is a multiple of R c , the proof is also obvious. Finally, when x = k'R c + m' with 1 < m' < R c — 1, we 
have r + x = (k + k')Rc + m' + 1. Again the proof relies on Lemma 1. □ 

4 Related works 

Dolev et al. are the first to address the approximate consensus problem in the presence of failuresJT]. 
Under the assumptions that the network is fully connected and the total number of nodes is known, 
HI proposes reducing, selecting and average operations and then presents two consensus protocols in a 
synchronous and an asynchronous environment, separately. In (2), Abraham et al. improve the protocol 
proposed in [ 1 1: only 3/ + 1 nodes are needed in an asynchronous environment. 

Azadmanesh et al. extend approximate consensus to partially connected networks lfTTl[T2l . However 
without using flooding, they did not completely achieve global convergence. Approximate consensus 
problem is also addressed in multi-agent system ifTUl fPTl [141 [3l |4 1 . These protocols are called linear iter- 
ative consensus and mainly based on linear control theory and matrix theory. Without Byzantine failure, 
iflOl indicates that in an undirected graph a sufficient and necessary condition for convergence consists in 
having adequate joint connected graphs. For a directed graph, lTT3ll points out that a sufficient and neces- 
sary condition consists in having a spanning tree contained in adequate joint connected graphs. When no 
Byzantine failure occurs, the speed of convergence was analyzed in lfl4l . Based on the knowledge of the 
global topology, and (4 1 address approximate consensus problem in systems where nodes suffer from 
Byzantine faults. 

Without flooding and global topology information, to our knowledge, |8 1 is the first paper where a so- 
lution to the approximate Byzantine consensus problem based on the linear iteration method is proposed. 
A sufficient condition on the network topology is proposed. When this condition is satisfied, convergence 
is ensured. 

While [8] only shows a sufficient condition, (7) and J5] define a sufficient and necessary condition 
almost simultaneously. Their new arguments are also related to topology. Yet their conditions are static 
and can not be adapted directly to mobile environments. 

Convergence and gathering problems in environments with mobile robots are also similar with ap- 
proximate consensus. Each robot needs to make the next moving action according to the results returned 
by its sensors lfl5ll . However they did not consider any topology requirements: each robot can sense all 
the other ones. 

5 Sufficient & Necessary Condition 

The sufficient and necessary conditions proposed in previous works Q |8] [9] consider a static topology. 
In our mobile system, the topology is not fixed and changes each time a node moves. From Corollary 1, 
we know that each time a common new starting round r is reached, v max can no more increase and v m i„ 
can no more decrease in the future. But, for example, if the network is partitioned into two disconnected 
sub-networks, an approximate agreement cannot be reached: nodes that belong to the first group may 
converge to a value vl while the others may converge to a value v2. Even if, during each round r, 
Vmax{r) can continue to decrease or v m i n (r) can continue to increase, this does not guarantee that the 
convergence property will be satisfied. 

In this paper a sufficient and necessary condition is proposed. This condition is compatible with 
the fact that the topology is always changing. Moreover, by its very definition, the proposed condition 
consider the dynamic evolution of the distribution of values within the system. More precisely, it focuses 
on the particular correct nodes that have currently either the value v m i n or the value v max . At least one 
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of these nodes has to receive from its neighborhood enough messages (quantity constraint) that contain 
values different from its own current value (quality constraint). 

To formally define what is expected in terms of quality, we first provide the definition of a proper 
value. The problem definition (See Section |2]i refers to a parameter e which sets the level of precision 
that needs to be obtained to consider that an agreement is reached. We introduce a second parameter 
called S whose range of possible values is (0, §]. This parameter, which is not used in the protocol, 
is necessary to define the condition and the notion of proper value on which the condition relies. This 
non-zero positive integer (whose value may be very small) allows us to define five intervals of values 
as follows. When a common new starting round r € S c begins, all correct nodes have values in the 
range [v m i n {r),v max (r)}. Five value intervals are defined. Minimum value corresponds to the value 
v m i n (r). Maximum value corresponds to the value v max (r). Nearly minimum value represents the value 
interval (v m i n (r) , v m i n (r) + 6). Symmetrically, Nearly maximum value represents the value interval 
(v ma x( r ) — 8, v max (r)). Finally, Middle value represents the value interval [v m i n (r) + 5, v max (r) — 6]. 
These three intervals are defined at the beginning of a new phase (i.e. just before a round r = kR c + 1 
begins) and will not change during R c consecutive rounds. During a round r' of the phase k (r < 
r' < r + R c ), a correct node pi may change its value Uj. Depending on its value Vi(r'), a correct node 
is classified in one of the following five groups: CMin(r'), CNin(r'), CMid(r'), CNax(r'), and 
CMax(r'). The letter C at the beginning of the name of a group indicates that the members of the group 
are correct nodes. Throughout a phase k, the same interval of value is associated to a group. During a 
round r', the rule for assigning a correct node pi to a group is simple: the value Vi(r') must belong to the 
corresponding interval. During a round, a correct node belongs to exactly one group. By definition, the 
distribution of the nodes into the five groups may change at each round of a phase. Figure 4(a) summarize 
the above discussion. 

res* 

CNm(r ) CMidir ') CNaxir ') _ , . „ 

cmmt~> , A , a.(ri r5a ' <r+R c 



n — n 



VmJr) v„„„(r)+6 v„J.r)-S v„(r) 

(a) 

MmUr") Mnfr") Mid(r') Nax{r') Max(r") 



'.«(/") v_<r)- 3 y„Jr)-d v m (r) 

(b) 



Figure 4: Value intervals and node sets 



Byzantine nodes may exist in the system. They can propose values that belong to [v m i n (r) , v max (r)] 
but also values that are beyond this interval. If Byzantine nodes propose legal values, they also make 
sense. We use Max(r'), Min(r'), Nax(r'), Nin(r') and Mid(r') to represent groups that mix correct 
nodes and Byzantine nodes. Due to the Byzantine nodes, the value intervals corresponding to Mm(r') 
and Max(r') are enlarged respectively to (— oo, v m i n (r)} and [v max (r) 1 +oo). Of course, CMax(r') C 
Max(r'), CNax{r') C Nax{r'), CMid(r') C Mid{r'), CNin{r') C Nin{r'), and CMin(r') C 
Min(r'). Node that a Byzantine node can belong to several group during the same round. These five new 
groups are depicted in Figure 4(b). Except Max and Min, the three other groups can be empty. Nin 
and Nax are two special groups which are used to distinguish legal values that are sufficiently different 
from either the current minimal value v m i n or the current maximal value v max ■ 

The proposed condition only affects the nodes that have either the minimum value or the maximum 
value when a phase k begins. Let r = kR c + 1 be the first round of this phase. The targeted nodes belong 
to CMin(r) or CMax(r). 

Definition 3. For any common new starting point r £ S c and for any round r' such that r < r' < r + R c , 
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a proper value, from the point of view of a correct node that belongs to CMin(r) is a value Vj(r') that 
belongs to the interval [v min (r) + 5, +00) while a proper value, from the point of view of a correct node 
that belongs to CMax(r) is a value Vj(r') that belongs to the interval (—00, v max (r) — 5]. 

Note that a proper value is not necessarily a legal value. A proper value can be a fake value proposed 
by a Byzantine node. Based on the above definition, we can now express the proposed condition. 

Theorem 2. The convergence property is satisfied by the proposed protocol if the following sufficient 

condition always holds: 

Vr E S c such that v max (r) - v min (r) > e, 

3pi e C n such that pi € CMax(r) U CMin{r), 

3r' such that r < r' < r + R c , 

3V q e V such that V q C JN[' , 

I Vq |> / + 1 andVpj G V q , Vj(r') is a proper value. 

As long as the convergence test is not satisfied, for each phase (characterized by its associated com- 
mon new starting round r), at least one correct node p, among those which are members of the groups 
CMin(r) or CMax(r) must, at least once during the phase (i.e. during a round r'), compute a new value 
using / + 1 (quantity constraint) proper values (quality constraint) received during the current phase. As 
mentioned before, a proper value is not a legal value. But, due to the fact that at least / + 1 are gathered 
by p^ at least one of them is not removed during the reducing procedure and is a legal value. Note that 
the above condition does not ensure that either v min increases or v max decreases during a phase. In fact, 
several correct nodes may have the minimum value or the maximum value when the phase begins. The 
condition just ensures that at least one of them will increase or decrease its value. 

Now the reason why Nax and Nin have been defined is explained. The requirements expressed in 
Theorem 2 only focus on the nodes of the groups CMin(r) and CMax(r): the other correct nodes are 
not concerned. Suppose v max {r) — v min (r) > e and values from Nax and Nin are not excluded. In 
this situation, if the nodes that belong to CMin(r) and CMax(r) only receive values from respectively 
(vminir), v m i n (r) + S) and (v max (r) — S, v max (r)) and if all the other correct nodes do not change their 
values, then there may exist a value u > e, such that lim v max (r) — v m i n (r) — [i . 

r— »+oo 

Mobility has a strong impact on the fact that the condition can be satisfied or not. If some correct 
nodes are always moving far away, convergence can not be obtained. In fact, a correct node can remain 
isolated as long as it is neither in CMax(r) nor in CMin(r). But, of course, in many applications, a 
correct node can not always determine if it is currently concerned or not by the condition. The fact that 
the nodes in CMin(r) or CMax(r) can obtain enough proper values depends not only on the trajectory 
and the speed of the correct nodes. It depends also on the cardinality of the system (i.e. the cardinality 
of the five sets). For example, if the cardinality of the union set [J(Max(r') U Nax(r') U Mid(r')) 

r' 

(r' e {r, r + 1, ...,r + R c — 1}) is smaller than / + 1, no node of CMin(r) has the possibility to 
meet both the quantity and quality constraint. However, in that case, the cardinality of the union set 
U(Mn(r') U Nin(r') U Mid(r')) should be sufficient to ensure that at least one node that belongs to 

r' 

CMax{r) can collect enough proper values. 

Lemma 2. To ensure that at least one node (either in CMin or in CM ax) can collect enough proper 
values, the cardinality of the system must satisfy the following constraint: n > 3/ + 1. 

Proof. Suppose that there is only 3/ nodes in the network. Think about this situation | CM ax |= 1, 
I CMin |= 1, I CNax |= / - 1,| CNin |= / - 1 and | CMid |= 0. Moreover, the / Byzantine 
nodes propose values bigger than v max to the nodes in CMax and, at the same time, the / byzantine 
nodes propose values smaller than v min to nodes in CMin. In that case only / proper values can be seen 



Inria 



Reaching Approximate Byzantine Consensus in Partially-Connected Mobile Networks 



13 



by nodes in CMax and CMin. The cardinality of the system is not sufficient to provide "quantity" and 
"quality" simultaneously. 

While v max — v m i n > e, if n = 3/ + 1, there is always a chance to satisfy at least one node in 
CMax or CMin. The proof is by contradiction. Suppose there is no chance to gather enough proper 
values neither for the nodes in CMax nor for those in CMin. Suppose Byzantine nodes send / illegal 
values bigger than v max to nodes in CMax and send / values smaller than u m j„ to nodes in CMin or 
just keep silent. In that way the Byzantine nodes do not contribute to the satisfaction of the condition. 
The remaining 2/ + 1 are all correct nodes. Suppose | CMid |= 0, because any nodes belongs to CMid 
helps both the nodes of CMin and CMax to satisfy the constraints. So according to the pigeonhole 
principle, at least one of the following two inequalities must be true: | CMax + CNax |> / + 1 or 
| CMin + CNin |> / + 1. A contradiction. □ 

Let us now consider that the system is populated with a sufficient number of correct nodes: n > 3/+1. 
Even if the nodes travel arbitrarily within the system, we assume that the condition is always satisfied. 
First we prove two general lemmas related to the convergence property. By definition, the convergence 
property is a stable property. Once the convergence is reached, this property remains true. 

Lemma 3. Let r be a common new starting point. Ifv max (r) — v m i n (r) < e then convergence is already 
reached when round r starts. 

Proof. Let us assume that v m i n (r) is proposed by a correct node pi while v max (r) is proposed by a 
correct node pj. By definition, for any correct node pk, v m i n (r) < Vk{r) < v max (r). As r € S , due 
to Corollary 1, Vr' > r, v min (r) < v k {r') < v max {r). Therefore, Mr' > r, v min (r) < v min (r') and 
v max (r') < v max (r). Consequently, as v max (r) - v min {r) < e, Vr' > r, v max (r') - v mm (r') < e. 
Thus convergence is already reached when round r begins. □ 

Note that the fact that r is a common starting round is essential in the proof of Lemma [3] If r is not a 
common starting round, it could be the case that v max {r)—v m in{ r ) < e while v max (r+l)—v m i n (r+l) > 
e. 

Lemma 4. When a common new starting round r begins, convergence is already reached if and only if 
either CMin(r) = CMax(r) or CNax(r) n CNin(r) ^ 0. 

Proof. By definition, if convergence is already reached during a round r (that belongs or not to S c ), either 
all the values of the correct nodes are equal or they differ by at most e. In the first case, CMin(r) = 
CMax(r) and CNax{r) = CNin(r) = 0. In the second case, CMin(r) ^ CMax(r) and v max (r) — 
v m i n {r) < e. As S < |, we have v max (r) — 5 < v min (r) + 5. Thus CNax(r) n CNin{r) ^ 0. 
The first implication holds. To prove the second implication, let us first consider that CMin(r) = 
CMax(r). Due to Corollary 1, all the correct nodes will keep the common value in the future. Now if 
CNax{r) n CNin(r) ^ 0, there exist at least one correct node pi who has proposed a value Vi(r) which 
belongs both to (v min (r), v min (r) + S) and (v max (r) - 6, v max (r)). Thus v max {r) - S < v min (r) + S. 
By assumption, 6 belongs to (0, |]. Therefore, v max (r) — v min (r) < 26 < e. Again, due to Corollary 1, 
convergence is already reached when round r begins. □ 

Lemma 5. Let r € S c be a common new starting round such that convergence is not yet reached when 
r starts. Let u)\ be a positive integer (u\ > 1). Let and ^2 be two reals that belong to (0, 1] and such 
that: 

v m in(r + ioiR c ) = ft« m i„(r) 

Umax 

During the uj\ phases, if neither the minimal value increases (si — I) nor the maximal value decreases ( 
(,2 = lj then the two following predicates are both satisfied: 
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1. (| CMin{r + uj x R c ) \<\ CMin(r) |) or (| CMax{r + wii? c ) |<| CMax(r) |) 

2. Wl < 71 

Proof. Due to Corollary 1, it is obvious that we can rewrite v m i n (r + R c ) and v max (r + R c ) using the 
defined and ^- Let us assume that the minimal and the maximal values are stable during the ujiR c 
rounds: ft = 1 and q = 1. We demonstrate that, after each phase, the cardinality of at least one of the 
two sets decrease. The fact that the property holds when u>i = 1 allows us to conclude that the property 
holds for any value of w\. During the R c numbered r, r + 1, . . ., r + R c — 1, due to the necessary 
condition expressed in Theorem 2, there exists at least one round during which a "good" phenomena 
occurs. Let us consider the highest round r' during which the condition is true and let p. L be a node such 
that pi has gathered enough proper values: 3 V q C JN[ such that | V q \> f + 1 and \/pj £ V q , Vj (r') is a 
proper value. Without loss of generality, let us assume that pi belongs to CMin(r). Due to Corollary 1, 
Vi(r') > v m i n (r). Moreover, due to the condition, the reducing procedure and the average procedure are 
executed by node pi. During the reducing procedure, at least one value greater or equal to v m i n (r) + 6 
is not removed. In the worst case, all the other values used during the computation are equal to v m i n (r). 
Even in that case, the new computed value of pi is such that Vi(r' + 1) > v m i n (r). If r' is not the 
last round of the phase (and despite the fact that r' is the highest round of the phase during which the 
condition is true), it could be the case that pi computes again its new value during rounds r" such that 
r' < r" < r + R c . In the worst case, pi will compute the average between its own value (> v m i n (r)) and 
a set of gathered values all equal to v m i n (r). Thus, when the next phase begins, Vi(r + R c ) > v m i n (r). 
Consequently, if v min (r + R c ) = v min (r), at least one node (namely pi) belongs to CMin(r) but not to 
CMin(r + R c ). A similar reasoning can be adopted if pi belongs to CMaxir). As the number of nodes 
is finite, and as at least one node per phase is removed from either CMin or CMax, we can conclude 
that v m in and v max both remain stable during at most n — 1 phases if convergence was not yet reached 
during round r. It is always the case that v m i n (r + nR c ) > v m i n (r) or v max (r + nR c ) < v max (r). Thus 
the second predicate w\ < n also holds. 

□ 

We prove now Theorem 2. 
Proof. (Theorem 2) 

Let r be a starting round during which convergence is not yet achieved. From Lemma [5] we can 
conclude that there exist a positive integer u\ such that either v m i n (r + uj\R c ) = ft« m m(r) with 9l G 
(0, 1) or v max (r + uJiR c ) = K%v max {r) with ?i € (0, 1). Let d = v max (r) - v mm (r). In the first case 
we have: 

d > v max (r + U\Rc) (r). 
In the second case, 

(r + wiR c ). Due to Corollary 1, v min (r) < v mm (r + u>xR c ) and v max (r) > 
v ma x(r + ojiR c ). Therefore, in both cases: d > v max {r + uj\R c ) - v min (r + u)iR c ). 

The difference v max — v m i n will always decrease. Yet this is not sufficient to prove that eventually 
convergence is reached. To prove this last point, we have to show the existence of a finite integer r, such 
that: v max (TR c + 1) - v min (rR c + 1) < e. 

The proof is by contradiction. Suppose that the above condition is never satisfied. In other words, 
whatever the value of the integer r, the difference v max (TR c + 1) — w m m(ri? c + 1) only approaches a 
value /1 but /1 > e. Figure [5] depicts such a scenario. In this representation we assume that there exists 
always a real A such that: A > and v max [rR c + 1) — 7j min (ri? c + 1) = A + /i. 

In Figure [5] A is represented by the sum of Ai and A2. 

Due to Lemma [5] when r approaches to infinity, A approaches to 0. We will show that /.i is not a 
limit: the value of A may become less than zero and never become positive again. First we will show that 
there exists a particular positive value of A such that after a single execution of the average procedure 
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Figure 5: Example of value fx 

during a round r, the value of A becomes negative. Then we show that there exists a particular positive 
value of A such that after a finite number of execution of the procedure average, the value of A remains 
negative forever. 

First let us consider a particular phase k. Let r = (k — l)R c + 1 be the first round of this phase. Let d 
denotes the difference v max (r) — v m i n (r). Let us assume that at the beginning of phase k, the value of A 
is positive and equal to d — /i. Due to Lemma|5] there exists a round r' such that: CMin{r) = CMin(r') 
and CMax(r) = CMax[r') and (CMin(r) ^ CMin{r' + 1) or CMax(r) ^ CMax[r' + 1)). 

Let d! be the difference v max (r' + 1) — v m i n (r' + 1). We have d > d' . The value of A decreases 
by d — d' between round r and round r' + 1. The value of A is equal to d' — /.i during round r' + 1. 
This value is negative if d! < [i. First we compute an estimation of the minimal value d — d' that can be 
observed. Obviously, to ensure that the difference d — d' is as small as possible, either just the minimal 
value has to increase or just the maximal value has to decrease (but not both during the same round r'). 
As the two cases are symmetric, let us consider that the minimal value increases while the maximal one 
remains stable. Let us consider a node pi such that pi has the minimal value during round r' . This node 
may have again the minimal value during round r' + 1. In that case, v m i n (r' + 1) > V m i n {r') and 
d — d! — v m i n (r' + 1) — v m i n (r'). Our aim is to obtained an estimation (more precisely an under- 
estimation) of the difference d — d' . To be allowed to compute a new value, the node pi must gather at 
least / + 1 proper values (in the worst case, these value can be equal to v m i n (r') + 5). After the reducing 
procedure, pi keeps at most n — f values. Furthermore at least one correct node propose a value greater 
than /i (otherwise this contradict the fact that the limit /i is respected between round r and r'). Yet as 
our goal is just to provide an under-estimation, we consider an (unrealistic) worst case. The new value of 
node pi computed during round r' during the execution of the average procedure is the average between 
n values where n — 1 are equal to v m i n (r') and a single one is a proper value (more precisely, the minimal 
proper value, namely v m i n (r') + S). In that case, we have: 

v mm {r> + 1) > 

As the right part of the above formula is an under-estimation, we use the symbol ">" rather than the 
symbol ">". Based on the previous formula, we conclude that: 
d-d' > v mm (r') + f - v min (r') 

We have proved the existence of a particular positive value of A (during round r') that is small enough 
to imply that the value of A can be negative during the next round. If during round r', the value of A 
(which is equal to d — fi) is strictly less than then the value of A can be negative during round r' + 1. 
This contradict the fact that fi is a limit for v max — v min which is never violated. 

At this stage, we have just demonstrated that /i is not a limit. We now show that after some time, this 
limit will be breached permanently. To understand why a violation of the limit [i is sometimes transient, 
let us consider that during a phase a single node pi has the smallest value v m i n (r). During the first round 
of this phase, it may broadcast this value to all the other nodes and then compute a new value v m i n (r') 
which violates the limit /i. Unfortunately any other node may compute again a new value based on its 
own value and old values contained in their log that are less that v m i n (r') and possibly very closed from 
v m i n (r). As a consequence the value of pi may decrease again and respect again the limit fi. 

Let us consider a common new starting round r such that the limit /i is respected. Due to Lemma [5] 
after n — 1 phases, either all the nodes that have the minimal value or all the nodes that have the maximal 
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value during round r have now adopted either an higher value or respectively a smaller value. Again 
without loss of generality, let us consider the worst case where all the nodes (except one) where sharing 
the minimal value v m i n (r) during round r while a single node has a value equal to v m i n (r) + p. Again, 
our goal is to identify a limit x (even if this one is under-estimated) that shows that at a beginning of round 
r + nR c + 1, no value less than v m i n (r) + x remains in the system. Again, during each phase, at least 
one node pi ,which has the minimal value when the phase begins modifies its value and adopts during 
a round of the phase, a value which is at least equal to v min (r) + - (See the above discussion). In the 
worst case, this change occurs during the first round of the first phase denoted r. Then pi may compute 
again its value during the next nR c — 1 following rounds. If it receives only values that are equal to v m i n 
during these rounds, its value at the end of the phase is strictly greater than v min (r') + ^4w^- Once this 
last phase ends, the value of pi can no more decrease. Therefore, after at most n phases, all the correct 
nodes have a value that will remain greater than v m i n (r) + £ Rc . Consequently there exits a positive 
value of A such that the violation of the limit p is permanent. 

The condition is sufficient to ensure convergence. □ 

Regarding the fact that the condition is necessary, we identify a weaker condition. Indeed, the condi- 
tion does not have to be satisfied in each phase but only infinitely often. This modification of the condition 
has no major impact on the way we prove that the condition is a sufficient condition. Some properties are 
no more satisfied "at the end of each phase" but "after a finite number of phases". 

To prove that the condition is necessary, we show that the quantity constraint and the quality constraint 
are both necessary. Within the set of n nodes, let us assume that half of the n — / > 2/ correct nodes 
share a same value v m i n while the second half share the value v max . We assume that v m i n and v max 
are such that the convergence is not yet reached. If a correct node gathers only / proper values before 
computing its new value, it could be the case that the values that remain after the execution of the reducing 
procedure are all equal to its own value. Thus no correct node will change its value. If a correct node 
gathers / + 1 values but at least one of them is not a proper value, it is also possible that all the proper 
values will be removed during the reducing procedure. Again, the values of the correct nodes will be 
stable and convergence is not ensured. 



6 Conclusion 

In this paper, we addressed approximate Byzantine consensus problem in partially connected mobile net- 
works. An architecture for both moving and consensus protocol has been proposed. Then an approximate 
consensus protocol based on a linear iteration method has been presented. In order to take advantage of 
mobility, in this protocol, nodes are allowed to collect messages during at most R c consecutive rounds. 
Afterwards, we have defined a sufficient and necessary condition that allows to satisfy convergence. 
Compared to existing papers, this novel condition is dynamic and not "universal". It only focuses on the 
correct nodes which propose the maximum or the minimum value and requires that, from time to time, 
at least one of them should receive enough (quantity constraint) proper (quality constraint) values. Our 
analysis shows that if n > 3/ + 1, the condition has chances to be satisfied and consensus can be reached. 
We are now working on particular mobility scenarios where either the existence of some meeting points 
or a predefined trajectory and scheduling allow to prove that the condition is satisfied. Simulations are 
also conducted to analyze the impact of a tuning of the R c parameter. 
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